1. Field of the Invention
The present invention relates to scanning for viruses on a computer system and more specifically to improving virus detection.
2. Background to the Invention
An extremely common problem in computing is the infection of a computer system with a so called virus. Viruses can take many forms but in general are software programs which make unwanted use of computer resources and in worst cases render a computer system unusable.
In order to combat such virus infections many software providers, such as Symantec Corp and McAfee Inc, provide virus scanning software which can be used to scan for the existence of viruses in files held in computer storage and take action to remove them. Further such software allows a user to tailor the virus scan which is performed. For example it is possible to specify directories of the file system to include in, or exclude from, the scan, and similarly file types or file extensions to include in, or exclude from, the scan. Further it is possible to specify a scan of running programs held in memory and a scan for extended threats, such as spyware and adware. This provides the user of virus scanning software with many ways of tailoring a virus scan to be performed to suit the needs of a user.
However a problematic aspect of existing virus scan software is that the order in which directories of the file system are scanned is arbitrarily selected, a common solution being to scan the directories included in a scan in alphabetic order. For example, consider a virus which exists in a file of the file system and which loads and re-boots the computer system a short time after the computer system is started. In this case, whether or not virus scanner software manages to detect and remove the virus within the short time the computer is running will depend on whether the arbitrary scan order which is used happens to search the appropriate directory within the time available. Thus there is no guarantee that such a virus can be detected and removed by prior art virus scan software.